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Nomenclature 

= total system angular momentum: vector, scalar magnitude 
= second moment of inertia: matrix, about the i axis 
= derivative gain: matrix, for i axis 
= proportional gain: matrix, for i axis 

= Sun vector; unit vector pointing from spacecraft to the Sun 
= target Sun vector 
= linear wheel friction coefficient 
= damping ratio 

= angle between total system angular momentum and target Sun vector 

= phase angle; angle between one plane, containing s and s t , and another plane containing s, and H 
= angle between total system angular momentum and Sun vector 
= torque command from controller to reaction wheels 
= Sun angle; angle between Sun vector and target Sun vector 
= angular rate: vector, i component 
= natural frequency 


I. Introduction 

The Solar Dynamics Observatory (SDO) mission is the first Space Weather Research Network mission, part of 
NASA’s Living With a Star program. 1 This program seeks to understand the changing Sun and its effects on the 
Solar System, life, and society. To this end, the SDO spacecraft will carry three Sun-observing instruments to 
geosynchronous orbit: Helioseismic and Magnetic Imager (HMI), led by Stanford University; Atmospheric Imaging 
Assembly (AIA), led by Lockheed Martin Space and Astrophysics Laboratory; and Extreme Ultraviolet Variability 
Experiment (EVE), led by the University of Colorado. Links describing the instruments in detail may be found 
through the SDO web site. 2 

The basic mission goals are to observe the Sun for a very high percentage of the 5-year mission (10-year goal) with 
long stretches of uninterrupted observations and with constant, high-data-rate transmission to a dedicated ground 
station. These goals guided the design of the spacecraft bus that will carry and service the three-instrument payload. 
At the time of this publication, the SDO spacecraft bus is well into the integration and testing phase at the NASA 
Goddard Space Flight Center (GSFC). A three-axis stabilized attitude control system (ACS) is needed both to point 
at the Sun accurately and to keep the roll about the Sun vector correctly positioned. The ACS has four reaction 
wheel modes and 2 thruster actuated modes. More details about the ACS in general and the control modes in 
particular can be found in Refs. [3-6]. 

All four of SDO’s wheel-actuated control modes involve Sun-pointing controllers, as might be expected from such a 
mission. Science mode, during which most science data is collected, uses specialized guide telescopes to point 
accurately at the Sun. Inertial mode has two sub-modes — one tracks a Sun-referenced target orientation, and another 
maintains an absolute (star-referenced) target orientation — that both employ a Kalman filter to process data from a 
digital Sun sensor and two star trackers. However, this paper is concerned only with the other two modes: Safe Hold 
(SH) and Sun Acquisition (SA). 
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II. Analysis of the SDO Safe Hold and Sun Acquisition Control Modes 

Safe Hold and Sun Acquisition have the same performance requirements: the Sun angle must be reduced to less than 
15 deg in less than 30 minutes from any attitude and any rates up to (o mas = [0.5, 0.6, 0.6] deg/sec. These 
requirements represent the initial acquisition of the Sun after launch. Though the launch vehicle is expected to 
perform much more benignly than these requirements, standard practice is to design the most basic safe modes of a 
system to survive worst-case situations. Both SH and SA control modes use an array of 8 coarse Sun sensors (CSS) 
to estimate a Sun unit vector, s, in the spacecraft body frame, and calculate attitude error based on the cross product 
of s with a target vector, s t , fixed in the body frame. Nominally, s t is equivalent to the spacecraft’s geometrically 
defined X axis; i.e. s t = [1 0 0] T . The control law for both controllers may be written 


Tend = - k d tO - k p (S X St ) ( 1) 

where T cmd is the commanded torque on the spacecraft, to is the spacecraft angular rate, and k d and k p are diagonal 
matrix gains 
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Because s t is along the X axis, k px always multiples a cross-product component equal to zero. So, let k px = 0 to avoid 
any later confusion. The difference between the two controllers is mainly in the derivation of the angular rate from 
available information. SA uses gyroscopes for three-axis rate information. SH is meant to be independent of the 
gyroscopes. So, SH estimates angular rates by taking differences of CSS and reaction wheel tachometer telemetry. 
Subsequent values of s are differenced to obtain angular rates perpendicular to s. When the X axis is within 15 deg 
of the Sun, subsequent values of the total angular momentum vector stored by the reaction wheels are differenced to 
obtain an estimate of the rate about the spacecraft X axis. Reference 4 provides a thorough description of the SDO 
Safehold controller, including its rate estimation algorithms. 

In both SH and SA, logic detects a condition of pointing nearly 180 degrees away from the Sun and adds a bias 
torque to help push the spacecraft away from the unstable equilibrium defined by the conditions s = -s t and to = 0. 
With this logic, the control law in Eq. 1 can be shown to be globally stable in the absence of disturbance torques. 7 
The requirements on k d and k p are comparable to those for a proportional-derivative controller in a linear system: 
k dx , k dy , k dz , k py , and k pz must all be positive. 

A. Gain Selection for Safe Hold and Sun Acquisition 

A brief discussion of the initial gain selection process for SH and SA will be helpful in understanding the updates to 
those gains presented in this paper. SA and SH were originally designed with the same set of gains. Basic 
performance goals guiding the initial design are: maximum overshoot less than 20%, 1% settling time of 600 sec, a 
very large separation between the controller bandwidth and the system sampling frequency (5 Hz), and a high 
damping ratio. The natural frequency of co n = 0.01 Hz and a damping ratio of C, = 0.8 is selected to meet all of these 
design goals with a good deal of margin. Common design techniques for PD control of a double-integrator plant 
were used to find proportional and derivative gains (normalized by moment of inertia, I) of kp/I = co n 2 = 0.0039 and 
k d /I = 2(;co n = 0.1005. 

These gains have performed well against mission requirements over two years of simulations. For a moment of 
inertia matrix of 
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the maximum system momentum implied by the above values for to max is 52.5 Nms. In high fidelity simulations 
with given gains, steady-state errors in the Sun angle are typically less than 5 deg, resulting mainly from the 
disturbance torques from reaction wheel friction and noise in the coarse Sun sensor signals and, for Safehold mode, 
from the wheel tachometer signals as well. Gyro noise is typically negligible in SA, and often SA performs slightly 
better than SH. In simulations as well as in the flight software, the reaction wheel commands are limited to 0.25 Nm 
of torque, and this torque limit is also a likely cause of some of the small errors. 

B. Simulation of Worst-Case Scenarios 

High-fidelity simulations are performed beginning from various initial attitudes, often in Monte Carlo batches. But, 
initial attitudes of 180 deg away from the Sun with maximum angular momentum are considered to represent a very 
important scenario due to limited torque from the reaction wheels. So, many more simulations are performed with 
these conditions than with any others. Both the SH and SA controllers show fast settling times for 180-deg starting 
conditions. For completeness, some Monte Carlo simulations are run with maximum momentum, but with initial 
Sun angle randomized for all attitudes, instead of starting around 180 deg away from the Sun. In one set of Monte 
Carlo simulations of the SH controller, two cases — Case 52 and Case 76 — do not meet performance requirements. 
These failures to acquire are remarkable in that not only had such failures not been seen in previous simulations, but 
also the failures involve quasi-steady-state errors much larger than linear theory would predict. By running the 
simulations longer than the 2100 sec chosen for that Monte Carlo, the failure cases are both seen to eventually 
acquire the Sun. Figure 1 shows the Sun angle trajectories of the 100 cases of that simulation, with the two failure 
cases highlighted. Note that Case 52 starts at about 120 deg from the Sun and Case 76 starts at about 90 deg. 
Figure 2 shows the angular rates about the X axis for the same 100 simulations. 


Sun Angle vs Time 
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Figure 1. Sun angle trajectories vs. time for 100 Monte Carlo simulations of the SDO Safehold controller. 
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Figure 2. X-axis angular rate vs. time for 100 Monte Carlo simulations of the SDO Safehold controller. 


Cases 52 and 76 stand out as holding at larger than usual Sun angles that occasionally go out of the required limits 
for SA and SH. They also share the trait of having constant, non-zero rates about the X axis, as seen in Fig. 2. 
Further simulations are run to develop a better sense of the dynamics at work and to check that the cause is not a 
simulation error. Again, the preponderance of cases perform well, even outside of the expected angular momentum 
regime, but a few other failure cases do appear. One of these cases, for which the system angular momentum is 
higher than the 52.5 Nms expected, shows the spacecraft requiring almost 3 hours to acquire within 25-30 deg of the 
Sun. This extreme case represents a potential failure to gain power-positive attitude before exhausting the battery 
power. Therefore, even though this simulation represents perhaps worse than a worst-case, the authors wish to 
understand the dynamics thoroughly. A good understanding of the dynamics at work is needed to determine whether 
some adjustment to the design can mitigate or eliminate this pecidiar failure mode and better guarantee Sun 
acquisition in extreme emergencies. 

A. Description of the Off-Pointing Dynamics 

The dynamics exhibited in these failure cases share certain hallmarks: 

1) The spacecraft Sun-pointing axis is oriented around a mean Sun angle further away from the Sun than 
most other cases; 

2) The spacecraft rotates at a roughly constant rate about that axis, as shown for Cases 52 and 76 in Fig. 2; 

3) At least one reaction wheel reaches either its torque saturation limit or its momentum cut-off limit; 

4) Tiny changes in initial conditions or random noise inputs can cause the simulated spacecraft to acquire the 
Sun as well as any other successful run. 

This last point is the most distressing — repeatable failures can be addressed, but failures that come and go based on 
unrelated factors, as these do, are much more difficult to handle. Contrarily, it is very encouraging that only the very 
worst of the worst-case Monte Carlo simulations exhibit any of these failures. 
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B. Simplified Model 

A concentrated effort is undertaken to find a set of conditions which share some of the dynamic characteristics of 
these failures, but are much more repeatable. One result of that effort is that a highly simplified analog of the SDO 
system is shown to exhibit characteristics 1 and 2. Reference 7 describes this simplified analytical model in detail, 
so a summary of the assumptions and the predictive model will suffice for this paper. 

The spacecraft is assumed to have its Sun target vector, s t , aligned (or nearly aligned) with a principal axis. (This 
was called the X axis.) Three reaction wheels are modeled, and their spin axes are aligned with the principal axes of 
the spacecraft. Reaction wheel drag is assumed to be a linear function of wheel momentum, with coefficient a. The 
k p and k d gains are positive, and their Y- and Z-values are set to be equal; i.e. k py = k pz and kd y = k,| z . The external 
torques are assumed to be zero, so that the total system angular momentum, H, is constant and inertially fixed. The 
unit vector from the spacecraft to the Sun, s, is assumed to be inertially fixed, as well. 

With these assumptions, a new equilibrium Sun angle is found to be consistently predictable by the solution of a 
system of four nonlinear equations in five variables, Eqs. 4-7. The five variables are: co x , the X-axis angular rate; o, 
the angle between the Sun vector and the system angular momentum vector, H; 0, the angle between the X axis and 
H; £, the plane angle between the plane shared by s and the X axis and the plane shared by H and the X axis; and <p, 
the Sun angle. An iterative method was used to solve the nonlinear system of equations. 


a H cos(9) 

= 

rp = sin" 1 

co x = -cot© a 

cos(o) = cos(0) cos(ip) + sin(0) sin©) cos©. (7) 

Qualitatively, the friction in the X-axis wheel causes a residual rate in the spacecraft about its X axis. The other 
equations define the spherical geometry of the inertially fixed vectors as functions of the constants of the system, 
such as system momentum and control gains. 


Hsin(0) co x ' 
k p cos© 


( 4 ) 

( 5 ) 

( 6 ) 


III. Application of the Simplified Model to the Real System 

The simplified model provides an analytical basis from which to approach the practical problem of how to guarantee 
that SA and SH will perform predictably under the conditions that define its operating regime. Even if the conditions 
specified are severe, it is expected that small increases in severity would result in only small decreases in 
performance. The failure mode under investigation is troublesome because small changes in any direction — more or 
less severe — can cause a previously failing scenario to succeed. As an example, in one failing simulation, the system 
momentum is reduced to 99% of its failure value, and the spacecraft is able to acquire the Sun. But, when the system 
momentum is increased to 104% of its failure value, that simulation also acquires. For that case, with all other 
conditions being identical, only momentum values from 100-102% of the failure value cause failures. As another 
demonstration of the difficulty of working with this system, some failure cases are repeatable only when the noise 
seeds are identical — changes in the actual noise values, and no other differences, are enough to cause the system to 
acquire the Sun successfully. It is important to approach the problem from an analytical basis, rather than to find 
new gains by trial and error and depend on Monte Carlo simulation to verify effectiveness. 

Case 52 has an angle between s and H of approximately 45 deg. Using the gains defined above, the expected 
equilibrium Sun angle, assuming a wheel friction coefficient of a = 0.001 Nm/Nms (comparable to observed 
values), is <p = 0.15 deg. This is two orders of magnitude less than the observed value of about 15 deg, so other 
factors are in play. The differences between the simplified model and the high fidelity model are as follows: 
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1) Sun vector rotating at the rate of Earth’s revolution (approximately 0.04 arcseconds/sec) 

2) External torques on the spacecraft, such as solar radiation pressure and gravity gradient 

3) Sensor and actuator noise and biases 

4) Nonlinear wheel friction model 

5) Pyramid arrangement of four wheels, instead of rectilinear arrangement of three wheels 

6) Controller limiting of command torques to reaction wheels 

7) Momentum limiting in wheels due to the wheels’ anti-runaway circuits 

The high-fidelity and simplified models are both used to test the importance of these elements. For the first two, the 
effect on the dynamics is minute enough that no differences in behavior were seen. When sensor and actuator noise 
is turned off, cases that have previously failed do sometimes acquire. The general character of the system dynamics 
does not change much, however, and since the simplified model demonstrates that the basic dynamics of the off- 
pointing equilibrium do not require noise, we reject noise as a proximate cause. 

For a brief period of time, the wheel friction model is thought to be the principal cause of the failure. The first 
friction model used predicts considerably more friction than data from the wheel vendor suggested. The heavier 
friction is seen in most contexts as a way to run simulations in which the onboard wheel friction modeling does not 
match the friction modeled as truth. But at the time, it is thought that in the case of the Sun-pointing mode 
acquisition difficulties, it is one too many elements of a worst-case scenario. Implementing a more realistic, yet still 
conservative, wheel friction model does cause the previously failing cases to succeed. However, the analysis of the 
dynamics allows that greater system momentum values could result in even the lesser wheel friction eventually 
reaching the point of causing this particular failure mode to occur again. On a spacecraft mission just entering the 
integration and testing phase at that time, it seems likely that the moment of inertia for the spacecraft will increase, 
and therefore the rates of [0.5, 0.6, 0.6] deg/sec will translate into more system momentum. The effects of higher 
momentum values (up to 60 Nms) are investigated, and in fact some similar failure cases do occur. These additional 
cases require further analysis of the complexities of the high fidelity model. 

The limiting of the actuators, in both torque and total momentum storage, appears to be important. Failures occur 
more frequently in simulations for which one of the four wheels is disabled. There are signs that torque saturation 
occurs very frequently in all simulation runs. Momentum saturation also occurs in the worst of the failure cases. The 
momentum limit is reduced for the purpose of simulation to maintain some momentum storage margin. All of these 
signs point to the expected limits on the reaction wheels as a primary cause of the failures. Further investigation 
shows that undersizing the controller gains can reproduce similar dynamical characteristics with more consistency 
and without limits on the reaction wheels. In a rough sense, the self-limiting of the reaction wheels has the effect of 
increasing the disturbances from the wheels relative to the control gains applied to reject those disturbances. 
Actuator limiting of both torque and momentum is now the best hypothesis for why the large control gains were not 
preventing the off-pointing equilibrium in the way predicted by linear theory or by the simplified model. Increasing 
the momentum limits of the wheels to expected levels eliminates all further appearance of large equilibrium Sun 
angles. However, this change also effectively eliminates some of the momentum storage margin that the design is 
supposed to maintain. It is determined that possible design changes to regain effective margin should be 
investigated. 


IV. Design Changes to Guarantee Performance 

At the phase in the mission when these failure cases are being investigated, the control system design is considered 
mature. It is undesirable to make any changes at all to the design, and yet, it is also undesirable to have what seems 
to be a possible failure mode. One elegant idea is to add an integrator on the rate signal in the X axis. That would 
theoretically eliminate the residual angular rate in the X axis, and ought therefore to prevent the off-pointing 
equilibrium. However, this rate integration would be a signifcant change to the controller design, carrying 
implications for stability analysis and invalidating most of the experience the analysts have with the SA and SH 
controllers. Also, it is conceivable that other problems might be introduced by integrating the rate signal. For the 
gyroscope-based SA mode, the output of the rate-integrating gyro could be used directly, but for SH, the 
differentiation of the reaction wheel tachometer signals already produces an X-axis rate signal that is so noisy it 
requires considerable filtering. Integrating that noisy signal is not a good solution for the SH mode. So, the most 
plain answer to the design dilemma is not feasible. 
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The least disruptive change to both SA and SH is to change the controller gains and the attitude error limit. 
Changing the gains can help prevent the off-pointing equilibrium in two ways. By increasing k<] x relative to other 
gains, the residual rate in the X axis would be less, whatever the drag characteristics of the wheels. By increasing k py 
and k pz relative to other gains, the Y and Z axis control loops would acquire the Sun more forcefully. However, 
simply increasing those gains would tend to cause more torque and momentum saturation, which has been identified 
as the most likely proximate cause of the problem. Also, the control loops of the three axes of SDO are tightly 
coupled by the pyramid arrangement of the reaction wheels. Control torques requested by the Y and Z axis control 
laws are combined with those from the X-axis control. After they are combined, the torques are limited by the 
software to 0.25 Nm for each wheel. The software scales all the wheel torque commands together, so that the total 
torque direction is the same as that requested by the control laws, but the end effect is that if any axis requests too 
much control effort, all three axes are limited. So, the total torque requests from the control law actually needed to 
be reduced, not increased. Therefore, the five control gains must be prioritized and chosen with an eye toward 
prevention of unhelpful torque saturation. 

Using the simplified dynamical model, a set of rules is developed to select new gains. The elimination of X angular 
rate is set as the highest priority, followed by rapid acquisition of the Sun by the Y and Z control laws. This 
prioritization is enforced by determining that the command torque requested by the X control law at the lowest 
critical X rate, T cmd>x = k dx co XjCrit , should be equal to the maximum torque requested by the Y or Z control laws for 
attitude correction, x C md,au = k p <pi, m , multiplied by an arbitrary safety factor of 4. The critical X rate selected 
corresponds to that calculated from Eq. 4 if the entire system momentum were in the X axis; i.e. if 0 = 0. q>u m is 
selected such that the maximum attitude command is comparable to the torque saturation limit. Finally, k dy and k dz 
are set according to desired natural frequency and damping for the Y and Z control laws. Note that these rules do not 
prevent the torque commands from being limited. Instead, taken all together, these rules guarantee that if the 
spacecraft is in the off-pointing equilibrium situation, and the torque commands are limited, then the majority of the 
control effort will be given to the X control law so that the X rate will be reduced more strongly than the attitude 
will be acquired. It is a bit counterintuitive, but the simplified nonlinear model shows this strategy to be correct. The 
final gains and limit selected are: k dx /I xx = 0.104, k^/I^ k dz /I zz = 0.042, kpy/Iyy = k pz /I zz = 0.00068, and <pii m = 10 deg. 


V. Conclusion 

Monte Carlo simulations of SDO’s Sun-pointing controllers show that performance goals are rarely not met with 
comfortable margins despite adherence to all usual linear design practices. The dynamics exhibited in these cases 
shares certain dynamical characteristics: in each case, the spacecraft Sun-pointing axis is oriented around a mean 
attitude well away from the Sun, the spacecraft spins at a roughly constant rate about that axis, and the reaction 
wheels reach their limits in either torque or momentum capacity, or both. Investigation shows that reducing the 
controller gains causes similar behavior. 

A simplified system representing the SDO Sun-pointing control modes is modeled. Predictive rules are established 
for this system, such that knowledge of the system mass properties, wheel friction characteristics, and controller 
gains predict a fixed off-pointing angle between the desired Sun-pointing axis and the actual Sun direction. Realistic 
complexities are gradually added back into the system, but predictive capabilities of the simplified model for the 
more complex system are very limited. By referring to the simplified model, additional design rules for the gains 
and attitude error limits are established to reduce the likelihood that the poor performance condition discussed here 
could result. The rate gain for the Sun-pointing axis is increased in relation to the other gains, so that the spacecraft 
cannot easily spin about that axis. The attitude gains and error limit are then selected to minimize occurrences of 
reaction wheel torque and momentum limiting. 

This work provides a strong reminder that single-axis, linear design practices may not give expected results, even 
when the design is one that has been used on many missions. The more effects that nonlinearities have in the system, 
the more important cross-axis couplings may become, and the less that linear measures of performance are useful as 
a guarantee of good performance. 
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